1033006 - Use-after-free bug in BasicCodeModules::BasicCodeModules

Status: RESOLVED FIXED

(Toolkit :: Crash Reporting, defect)

Description

[(inactive) Jim Chen [:jchen] [:darchons]]

In BasicCodeModules::BasicCodeModules, if RangeMap::StoreRange fails for whatever reason, the |module| pointer is immediately freed at the end of the StoreRange call because of the temporary linked_ptr object passed in as a parameter. However, the code calls |module->code_file()| immediately afterwards, therefore using |module| after it has been freed.

[1] http://mxr.mozilla.org/mozilla-central/source/toolkit/crashreporter/google-breakpad/src/processor/basic_code_modules.cc?rev=83c09fe3a658#67

Comment 1

[(inactive) Jim Chen [:jchen] [:darchons]]

Attachment: Don't free pointer in BasicCodeModules::BasicCodeModules before possibly using it (v1)

I will get this reviewed upstream if it looks good.

Comment 2

[(not currently active) Ted Mielczarek]

Comment on attachment 8450357 [details] [diff] [review]
Don't free pointer in BasicCodeModules::BasicCodeModules before possibly using it (v1)

Review of attachment 8450357 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch. I can land this upstream for you if you remind me.

Comment 3

[(inactive) Jim Chen [:jchen] [:darchons]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/67001e68b078

Comment 4

[(inactive) Jim Chen [:jchen] [:darchons]]

Attachment: breakpad-bug-1033006.patch

Upstream patch

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/67001e68b078

Comment 6

[(not currently active) Ted Mielczarek]

Upstream:
https://code.google.com/p/google-breakpad/source/detail?r=1346